ccd146b7fd75d1420a0b58a91533b33c3b7e04237cc93f8759c4a44b244732e6

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rlient.exe
Size 425KB
Sample260809-j6sk6sbr51
SHA256 ccd146b7fd75d1420a0b58a91533b33c3b7e04237cc93f8759c4a44b244732e6
MD5 66e8281e9ddd6ee05cf13ae6c817a326
SHA1 39a827f954f27266b217cb6e4eccd229cfe6a5b9
SHA512 0b7e14f78c982b7b4ea2909cb34ccdc850a5ca56da7d2b3369206e6d78f6730839d2ce651709cf2fb735bfe45dbfdf37833912adcc4478d6dbe3a12e83899991
SSDEEP 12288:8UNhCeO5pRpRFO7wxuHeK83p3+1+B7x1K+z1ON:8UNhCOm913o
TLSH
T15C9406CD326071DFD8A7D931CEA81DA8AE3178A7972B8107902711ED9D5D987CF242B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3240	powershell.exe
4460	powershell.exe
5512	powershell.exe
4544	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rlient.lnk	Rlient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rlient.lnk	Rlient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rlient = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Rlient.exe"	Rlient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
4460	powershell.exe
4460	powershell.exe
4460	powershell.exe
5512	powershell.exe
5512	powershell.exe
5512	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4140	Rlient.exe
4140	Rlient.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	Rlient.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeIncreaseQuotaPrivilege	3240	powershell.exe
Token: SeSecurityPrivilege	3240	powershell.exe
Token: SeTakeOwnershipPrivilege	3240	powershell.exe
Token: SeLoadDriverPrivilege	3240	powershell.exe
Token: SeSystemProfilePrivilege	3240	powershell.exe
Token: SeSystemtimePrivilege	3240	powershell.exe
Token: SeProfSingleProcessPrivilege	3240	powershell.exe
Token: SeIncBasePriorityPrivilege	3240	powershell.exe
Token: SeCreatePagefilePrivilege	3240	powershell.exe
Token: SeBackupPrivilege	3240	powershell.exe
Token: SeRestorePrivilege	3240	powershell.exe
Token: SeShutdownPrivilege	3240	powershell.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeSystemEnvironmentPrivilege	3240	powershell.exe
Token: SeRemoteShutdownPrivilege	3240	powershell.exe
Token: SeUndockPrivilege	3240	powershell.exe
Token: SeManageVolumePrivilege	3240	powershell.exe
Token: 33	3240	powershell.exe
Token: 34	3240	powershell.exe
Token: 35	3240	powershell.exe
Token: 36	3240	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeIncreaseQuotaPrivilege	4460	powershell.exe
Token: SeSecurityPrivilege	4460	powershell.exe
Token: SeTakeOwnershipPrivilege	4460	powershell.exe
Token: SeLoadDriverPrivilege	4460	powershell.exe
Token: SeSystemProfilePrivilege	4460	powershell.exe
Token: SeSystemtimePrivilege	4460	powershell.exe
Token: SeProfSingleProcessPrivilege	4460	powershell.exe
Token: SeIncBasePriorityPrivilege	4460	powershell.exe
Token: SeCreatePagefilePrivilege	4460	powershell.exe
Token: SeBackupPrivilege	4460	powershell.exe
Token: SeRestorePrivilege	4460	powershell.exe
Token: SeShutdownPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeSystemEnvironmentPrivilege	4460	powershell.exe
Token: SeRemoteShutdownPrivilege	4460	powershell.exe
Token: SeUndockPrivilege	4460	powershell.exe
Token: SeManageVolumePrivilege	4460	powershell.exe
Token: 33	4460	powershell.exe
Token: 34	4460	powershell.exe
Token: 35	4460	powershell.exe
Token: 36	4460	powershell.exe
Token: SeDebugPrivilege	5512	powershell.exe
Token: SeIncreaseQuotaPrivilege	5512	powershell.exe
Token: SeSecurityPrivilege	5512	powershell.exe
Token: SeTakeOwnershipPrivilege	5512	powershell.exe
Token: SeLoadDriverPrivilege	5512	powershell.exe
Token: SeSystemProfilePrivilege	5512	powershell.exe
Token: SeSystemtimePrivilege	5512	powershell.exe
Token: SeProfSingleProcessPrivilege	5512	powershell.exe
Token: SeIncBasePriorityPrivilege	5512	powershell.exe
Token: SeCreatePagefilePrivilege	5512	powershell.exe
Token: SeBackupPrivilege	5512	powershell.exe
Token: SeRestorePrivilege	5512	powershell.exe
Token: SeShutdownPrivilege	5512	powershell.exe
Token: SeDebugPrivilege	5512	powershell.exe
Token: SeSystemEnvironmentPrivilege	5512	powershell.exe
Token: SeRemoteShutdownPrivilege	5512	powershell.exe
Token: SeUndockPrivilege	5512	powershell.exe
Token: SeManageVolumePrivilege	5512	powershell.exe
Token: 33	5512	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4140	Rlient.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3240	4140	Rlient.exe	89
PID 4140 wrote to memory of 4460	4140	Rlient.exe	92
PID 4140 wrote to memory of 5512	4140	Rlient.exe	94
PID 4140 wrote to memory of 4544	4140	Rlient.exe	96
PID 4140 wrote to memory of 5704	4140	Rlient.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Rlient.exe
"C:\Users\Admin\AppData\Local\Temp\Rlient.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Rlient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Rlient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Rlient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Rlient.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Rlient" /tr "C:\Users\Admin\AppData\Local\Temp\Rlient.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5704

C:\Users\Admin\AppData\Local\Temp\Rlient.exe
C:\Users\Admin\AppData\Local\Temp\Rlient.exe
1⤵
PID:5228

C:\Users\Admin\AppData\Local\Temp\Rlient.exe
"C:\Users\Admin\AppData\Local\Temp\Rlient.exe"
1⤵
PID:3144

C:\Users\Admin\AppData\Local\Temp\Rlient.exe
"C:\Users\Admin\AppData\Local\Temp\Rlient.exe"
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4fb025787851a7d907bbb74dbaa2bcf930c1393531cdf7e15b15460ab7045df7
MD5 98a96e7770bb7fc45245188075c743a3
SHA1 4053ea73bf4fd366f0c599af969f6988333b0879
SHA512 ccd89245c49d484fc38e1e4ae00c7306b5bb6e633294cfbecd20a65bb1703152f7ebaf3232f49f4e8787ea9d20055d7ca1d3e4c4d4d77629efb2f3331eb9d108
TLSH
T1C9216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 287307bc450d600c2d2233396ad78e35ee001205892e0d2fc4efa4360072a1f1
MD5 f2684c7854803536deceb634bf57a66e
SHA1 8366f500568baf114ab96fea3eeda17059e1aecc
SHA512 950698f0f8333a851372bf36e6466da24f08b320d1b2764655b41be5ca5f992e54fd49366aa0b91bf4c328735099368730df9d6fff217a6abb073afbfbcfed61
TLSH
T148219833B3DC8624C89A013A10CDAC1036B6C7CB40DECFAB6B80E655A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0ycmppcm.bwu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ycmppcm.bwu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3240-25-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-27-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-36-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-7-0x000001CB0BBEC000-0x000001CB0BBED000-memory.dmp

Download

memory/3240-10-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-28-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-12-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-13-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-14-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-15-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-16-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-19-0x000001CB24350000-0x000001CB2436E000-memory.dmp

Download

memory/3240-20-0x000001CB245C0000-0x000001CB24672000-memory.dmp

Download

memory/3240-21-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-23-0x000001CB24370000-0x000001CB2437A000-memory.dmp

Download

memory/3240-24-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-34-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-22-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-33-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-26-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-11-0x000001CB0B360000-0x000001CB0B382000-memory.dmp

Download

memory/3240-29-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-30-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-31-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/3240-32-0x000001CB0B450000-0x000001CB0BDF4000-memory.dmp

Download

memory/4140-5-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp

Download

memory/4140-0-0x00007FFA5A66F000-0x00007FFA5A670000-memory.dmp

Download

memory/4140-6-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp

Download

memory/4140-4-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp

Download

memory/4140-3-0x0000000000950000-0x0000000000956000-memory.dmp

Download

memory/4140-2-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp

Download

memory/4140-47-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp

Download

memory/4140-1-0x0000000000080000-0x00000000000F2000-memory.dmp

Download

memory/4140-57-0x00007FFA5A4E0000-0x00007FFA5AE84000-memory.dmp

Download

memory/4460-43-0x000001BE06760000-0x000001BE07104000-memory.dmp

Download

memory/4544-59-0x0000017EC8D00000-0x0000017EC96A4000-memory.dmp

Download

memory/5512-51-0x000002A4C89A0000-0x000002A4C9344000-memory.dmp

Download